Automobiles are equipped with electronic control units (ECUs) each for controlling various electronic apparatuses to be controlled. Each ECU has a main control unit composed of a CPU, and performs control processing of electronic apparatuses mounted on the automobile based on execution of predetermined control software. This control software is recently stored in a flash ROM (flash memory) so that its contents can be updated at any time for version-ups, correction of bugs, etc. of stored application programs (U.S. Pat. No. 6,249,848 corresponding to JP 10-111863A; US 20030221049A1 corresponding to JP 2003-337748A; JP 2003-172199A; and JP 2001-229014A).
Conventionally, update processing of an application program is often done in a car dealer shop etc. into which the owner brings in a vehicle. In recent years, the spread of vehicle external infrastructures using radio communication (for example, a portable phone network etc.) is paving a way to possible scenario of addition of functions and updating of map data in a car navigation system, distribution of music software used by the car audio system, etc. which might be executed by the users themselves. In this case, the update processing is performed by downloading an update version of control software by wireless reception from the external infrastructure and writing it in a flash ROM, while the user is using a vehicle.
The stored program is updated to a new version, while the old version control software is being used by the user. The rewrite processing is performed by overwriting (or invalidating) an old version of control software in the flash ROM. In case where the rewrite processing of a new version of software has failed for some reason (for example, communication failure, bugs and erroneous operation of rewrite processing, hardware abnormality, etc.) during the rewrite processing, old version software as well as new version software becomes unusable or suffers dysfunction. This causes serious influence on providing functions to the user.
Further, when the update processing is to be performed, it is necessary to perform version-up processing of the application program (function controlling software) of an automobile using a program for rewriting (rewriting firmware) prepared apart from the function controlling software. In the case of an ECU carried on an automobile, in contrast to OS etc. of a personal computer, it is rare that the users direct their attentions to rewrite processing itself regarding version-up of the mounted application program. In most cases, a person in charge of a dealer shop performs the rewrite processing actually. For example, in the case where the ECU is configured to start an extra routine regarding rewriting of the application program when the ECU is restarted after resetting, not only the ECU does not operate automobile functions that the user usually enjoys but also transfers into an input waiting state of the rewrite processing, which the user can hardly understand and may be driven into confusion. By such a reason, when restarting the ECU after resetting it, the ECU is configured in such away that a main body part (function realizing program part) of the application program starts always before the rewriting program. In the case where the ECU is intended to transfer to the rewrite processing, the rewriting firmware is started by command input from this application program specifically, in one of execution steps of the above application program, the rewriting firmware receives a start command being entered from an interface for maintenance that general users do not operate usually. For example, it is realized in a touch panel screen that is called by an exclusive command or by input tool connection to an exclusive connector.
Meanwhile, when the rewrite processing is performed in such a way that an update version program is overwritten on an old version program (invalidated) in a flash ROM, there is a case where the rewrite processing fails because of some cause (for example, electric power cutoff of the ECU, communication failure, bugs and erroneous operation of the rewrite processing, hardware abnormality, and connector dropout in the case where rewriting is performed with an exclusive rewriting tool bearing the update version program being connected to an in-vehicle network, and the like) during the rewrite processing of the update version program. In this case, the failure causes the old version program as well as the update version program to be unusable or fall into dysfunction, which gives serious effects on providing functions to the user. As a natural consequence of this, it is required to perform again the rewrite processing of the application program.
However, like the above conventional ECU, when the rewriting firmware is configured to receive the start instruction from the application program side, once the rewrite processing of the application program fails, normal start of the application program cannot be expected at all after that. As a result, it is no longer possible to start the rewriting firmware in order to repair this. Therefore, re-execution of the rewrite processing will become impossible. In this case, what is required in order to solve this problem is to remove the ECU, attach it to an exclusive apparatus, and rewrite the contents of the flash ROM that stores the application program. However, it takes much time to remove the ECU mounted in a deep location of the vehicle body, which will lead to waste of unexpected time and labor for normal restoration.